diff mbox

fealnx: Write outside array bounds

Message ID 4A699FC2.2080407@gmail.com
State Superseded, archived
Delegated to: David Miller
Headers show

Commit Message

roel kluin July 24, 2009, 11:49 a.m. UTC
phy_idx is checked to be < 4, but np->phys[] is 2 elements long

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
Or should the number of elements be increased?

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Ilpo Järvinen July 25, 2009, 9:55 a.m. UTC | #1
On Fri, 24 Jul 2009, Roel Kluin wrote:

> phy_idx is checked to be < 4, but np->phys[] is 2 elements long
> 
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> ---
> Or should the number of elements be increased?
> 
> diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
> index 48385c4..100badd 100644
> --- a/drivers/net/fealnx.c
> +++ b/drivers/net/fealnx.c
> @@ -584,7 +584,7 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
>  	if (np->flags == HAS_MII_XCVR) {
>  		int phy, phy_idx = 0;
>  
> -		for (phy = 1; phy < 32 && phy_idx < 4; phy++) {
> +		for (phy = 1; phy < 32 && phy_idx < 2; phy++) {
>  			int mii_status = mdio_read(dev, phy, 1);
>  
>  			if (mii_status != 0xffff && mii_status != 0x0000) {

In either of the case, one should use ARRAY_SIZE(np->phys) instead of the 
number.
diff mbox

Patch

diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index 48385c4..100badd 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -584,7 +584,7 @@  static int __devinit fealnx_init_one(struct pci_dev *pdev,
 	if (np->flags == HAS_MII_XCVR) {
 		int phy, phy_idx = 0;
 
-		for (phy = 1; phy < 32 && phy_idx < 4; phy++) {
+		for (phy = 1; phy < 32 && phy_idx < 2; phy++) {
 			int mii_status = mdio_read(dev, phy, 1);
 
 			if (mii_status != 0xffff && mii_status != 0x0000) {